惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

S
SegmentFault 最新的问题
Google DeepMind News
Google DeepMind News
G
Google Developers Blog
Martin Fowler
Martin Fowler
MongoDB | Blog
MongoDB | Blog
月光博客
月光博客
Jina AI
Jina AI
宝玉的分享
宝玉的分享
人人都是产品经理
人人都是产品经理
D
DataBreaches.Net
V
V2EX
WordPress大学
WordPress大学
T
The Blog of Author Tim Ferriss
Last Week in AI
Last Week in AI
B
Blog
博客园 - 叶小钗
小众软件
小众软件
Stack Overflow Blog
Stack Overflow Blog
P
Proofpoint News Feed
A
About on SuperTechFans
J
Java Code Geeks
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
Y
Y Combinator Blog
Microsoft Security Blog
Microsoft Security Blog

吹比💨

NFS 服务引发的一次“诡异”应急响应 银狐使用WDAC来对抗杀软 浏览器第三方Cookie保护导致无法使用Github.dev 使用pushState伪造浏览器地址栏 一次排查网站劫持过程流水账 手动导出 Microsoft Authenticator 中的2FA密钥 使用CloudFlare的IP Lists功能来做访问控制 FrontJS网站错误监控插件存在弹窗广告 宝塔面板可能存在未知漏洞的分析与处置方法 CDN厂商解决域前置问题 中文域名那些事 TLS握手指纹(JA3/JA3S)检测恶意软件流量 [A-Z]{2}\d{2}.cc 团伙的一些公开信息 Azure旗下奇怪的静态托管服务 Csrf与浏览器第三方Cookie策略的问题 Pppoe密码嗅探 Publicsuffix那些事 一次有意思的域名追踪 CobaltStrike通信中host字段的获取 XFF那些事 CORB那些事 Referrer Policy那些事 使用CloudFlare来为网站开启客户端证书验证 DNS那些事 用flask来在线管理你的iptables 屏蔽掉向日葵的有效方法 帝国cms在防止内容采集方面做的工作 身份验证器是如何验证我们的身份? 利用GoogleAppsScript自动回复短信实现保号 Nginx实用模块
Whois协议理解与用途
榆木 · 2020-01-04 · via 吹比💨

前言

Linux下有whois命令可以帮助我们快速的查看IP/域名的whois信息,原先我一直以为这个命令是通过http接口来查询whois,然后注册商提供这个API接口…知道今天抓了一个包才发现一个完全不知道的协议—-“whois协议”

以下是我抓到的包(可以放大看下)

在"protocol"一栏清楚的写着"whois",这瞬间就是知识盲区了;追踪TCP流的内容如下:

huai.pub
VACY
Admin Postal Code: REDACTED FOR PRIVACY
Admin Country: REDACTED FOR PRIVACY
Admin Phone: REDACTED FOR PRIVACY
Admin Phone Ext: REDACTED FOR PRIVACY
Admin Fax: REDACTED FOR PRIVACY
Admin Fax Ext: REDACTED FOR PRIVACY
Admin Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.
Registry Tech ID: REDACTED FOR PRIVACY
Tech Name: REDACTED FOR PRIVACY
Tech Organization: REDACTED FOR PRIVACY
Tech Street: REDACTED FOR PRIVACY
Tech City: REDACTED FOR PRIVACY
Tech State/Province: REDACTED FOR PRIVACY
Tech Postal Code: REDACTED FOR PRIVACY
Tech Country: REDACTED FOR PRIVACY
Tech Phone: REDACTED FOR PRIVACY
Tech Phone Ext: REDACTED FOR PRIVACY
Tech Fax: REDACTED FOR PRIVACY
Tech Fax Ext: REDACTED FOR PRIVACY
Tech Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.
Name Server: uma.ns.cloudflare.com
Name Server: darl.ns.cloudflare.com
DNSSEC: signedDelegation
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of WHOIS database: 2020-01-04T15:45:47Z <<<

For more information on Whois status codes, please visit https://icann.org/epp

Terms of Use: Donuts Inc. provides this Whois service for information purposes, and to assist persons in obtaining information about or related to a domain name registration record. Donuts does not guarantee its accuracy. Users accessing the Donuts Whois service agree to use the data only for lawful purposes, and under no circumstances may this data be used to: a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the registrar...s own existing customers and b) enable high volume, automated, electronic processes that send queries or data to the systems of Donuts or any ICANN-accredited registrar, except as reasonably necessary to register domain names or modify existing registrations. When using the Donuts Whois service, please consider the following: The Whois service is not a replacement for standard EPP commands to the SRS service. Whois is not considered authoritative for registered domain objects. The Whois service may be scheduled for downtime during production or OT&E maintenance periods. Queries to the Whois services are throttled. If too many queries are received from a single IP address within a specified time, the service will begin to reject further queries for a period of time to prevent disruption of Whois service access. Abuse of the Whois system through data mining is mitigated by detecting and limiting bulk query access from single sources. Where applicable, the presence of a [Non-Public Data] tag indicates that such data is not made publicly available due to applicable data privacy laws or requirements. Should you wish to contact the registrant, please refer to the Whois records available through the registrar URL listed above. Access to non-public data may be provided, upon request, where it can be reasonably confirmed that the requester holds a specific legitimate interest and a proper legal basis for accessing the withheld data. Access to this data can be requested by submitting a request via the form found at https://donuts.domains/about/policies/whois-layered-access/ Donuts Inc. reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy.

正文

于是查找了一下相关资料,才知道这是一种运行在43端口上的协议…

当然在 /etc/services 也有收录

yumu@Deepin:~/Desktop$ cat /etc/services | grep "43"
whois		43/tcp		nicname

特点

TCP43端口就是他的特点, 一般都在whois.nic.[域名后缀]上运行,比如博主在用的.pub域名所使用的服务器就是whois.nic.pub.我们可以用telnet对其进行交互(框内是我输入的内容)

用途

用途也只有一个,那就是供用户查询,没有其他花里胡哨的作用,也没有华丽的界面功能.一视同仁,没有任何身份验证.